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1.An organization is referencing NIST best practices for BCP creation while reviewing current internal 
organizational processes for mission-essential items. 

Which of the following phases establishes the identification and prioritization of critical systems and 
functions? 

A. Review a recent gap analysis. 

B. Perform a cost-benefit analysis. 

C. Conduct a business impact analysis. 

D. Develop an exposure factor matrix. 

Answer: C 

Explanation: 

Reference: https://itsm.ucsf.edu/business-impact-analysis-bia-0 

According to NIST SP 800-34 Rev. 1, a business impact analysis (BIA) is a process that identifies and 
evaluates the potential effects of natural and man-made events on organizational operations. The BIA 
enables an organization to determine which systems and processes are essential to the organization’s 
mission and prioritize their recovery time objectives (RTOs) and recovery point objectives (RPOs).12 


2.An organization is preparing to migrate its production environment systems from an on-premises 
environment to a cloud service. The lead security architect is concerned that the organization's current 
methods for addressing risk may not be possible in the cloud environment. 

Which of the following BEST describes the reason why traditional methods of addressing risk may not be 
possible in the cloud? 

A. Migrating operations assumes the acceptance of all risk. 

B. Cloud providers are unable to avoid risk. 

C. Specific risks cannot be transferred to the cloud provider. 

D. Risks to data in the cloud cannot be mitigated. 

Answer: C 

Explanation: 

According to NIST SP 800-146, cloud computing introduces new risks that need to be assessed and 
managed by the cloud consumer. Some of these risks are related to the shared responsibility model of 
cloud computing, where some security controls are implemented by the cloud provider and some by the 
cloud consumer. The cloud consumer cannot transfer all the risks to the cloud provider and needs to 
understand which risks are retained and which are mitigated by the cloud provider.3 


3.A company created an external application for its customers. A security researcher now reports that the 
application has a serious LDAP injection vulnerability that could be leveraged to bypass authentication 
and authorization. 

Which of the following actions would BEST resolve the issue? (Choose two.) 

A. Conduct input sanitization. 

B. Deploy a SIEM. 

C. Use containers. 

D. Patch the OS 

E. Deploy a WAF. 

F. Deploy a reverse proxy 

G. Deploy an IDS. 
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Answer: AE 

Explanation: 

A WAF protects your web apps by filtering, monitoring, and blocking any malicious HTTP/S traffic 
traveling to the web application, and prevents any unauthorized data from leaving the app. It does this by 
adhering to a set of policies that help determine what traffic is malicious and what traffic is safe. 
According to OWASP, LDAP injection is an attack that exploits web applications that construct LDAP 
statements based on user input without proper validation or sanitization. LDAP injection can result in 
unauthorized access, data modification, or denial of service. To prevent LDAP injection, OWASP 
recommends conducting input sanitization by escaping special characters in user input and deploying a 
web application firewall (WAF) that can detect and block malicious LDAP queries.45 


4.In preparation for the holiday season, a company redesigned the system that manages retail sales and 
moved it to a cloud service provider. The new infrastructure did not meet the company’s availability 
requirements. During a postmortem analysis, the following issues were highlighted: 

1. International users reported latency when images on the web page were initially loading. 

2. During times of report processing, users reported issues with inventory when attempting to place 
orders. 

3. Despite the fact that ten new API servers were added, the load across servers was heavy at peak 
times. 

Which of the following infrastructure design changes would be BEST for the organization to implement to 
avoid these issues in the future? 

A. Serve static content via distributed CDNs, create a read replica of the central database and pull reports 
from there, and auto-scale API servers based on performance. 

B. Increase the bandwidth for the server that delivers images, use a CDN, change the database to a 
non-relational database, and split the ten API servers across two load balancers. 

C. Serve images from an object storage bucket with infrequent read times, replicate the database across 
different regions, and dynamically create API servers based on load. 

D. Serve static-content object storage across different regions, increase the instance size on the 
managed relational database, and distribute the ten API servers across multiple regions. 

Answer: A 

Explanation: 

This solution would address the three issues as follows: 

Serving static content via distributed CDNs would reduce the latency for international users by delivering 
images from the nearest edge location to the user’s request. 

Creating a read replica of the central database and pulling reports from there would offload the 
read-intensive workload from the primary database and avoid affecting the inventory data for order 
placement. 

Auto-scaling API servers based on performance would dynamically adjust the number of servers to match 
the demand and balance the load across them at peak times. 


5.During a remodel, a company’s computer equipment was moved to a secure storage room with 
cameras positioned on both sides of the door. The door is locked using a card reader issued by the 
security team, and only the security team and department managers have access to the room. The 
company wants to be able to identify any unauthorized individuals who enter the storage room by 
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following an authorized employee. 

Which of the following processes would BEST satisfy this requirement? 

A. Monitor camera footage corresponding to a valid access request. 

B. Require both security and management to open the door. 

C. Require department managers to review denied-access requests. 

D. Issue new entry badges on a weekly basis. 

Answer: B 

Explanation: 

Reference: https://www.getkisi.com/access-control 

This solution would implement a two-factor authentication (2FA) process that would prevent unauthorized 
individuals from entering the storage room by following an authorized employee. The two factors would be 
the card reader issued by the security team and the presence of a department manager. 


6.A company is preparing to deploy a global service. 

Which of the following must the company do to ensure GDPR compliance? (Choose two.) 

A. Inform users regarding what data is stored. 

B. Provide opt-in/out for marketing messages. 

C. Provide data deletion capabilities. 

D. Provide optional data encryption. 

E. Grant data access to third parties. 

F. Provide alternative authentication techniques. 

Answer: A, C 

Explanation: 

The main rights for individuals under the GDPR are to: 

allow subject access 

have inaccuracies corrected 

have information erased 

prevent direct marketing 

prevent automated decision-making and profiling 

allow data portability (as per the paragraph above) 

source: https://www.clouddirect.net/11-things-you-must-do-now-for-gdpr-compliance/ 

These are two of the requirements of the GDPR (General Data Protection Regulation), which is a legal 
framework that sets guidelines for the collection and processing of personal data of individuals within the 
European Union (EU). The GDPR also requires data controllers to obtain consent from data subjects, 
protect data with appropriate security measures, notify data subjects and authorities of data breaches, 
and appoint a data protection officer. 


7.A SOC analyst is reviewing malicious activity on an external, exposed web server. During the 
investigation, the analyst determines specific traffic is not being logged, and there is no visibility from the 
WAF for the web application. 

Which of the following is the MOST likely cause? 

A. The user agent client is not compatible with the WAF. 

B. A certificate on the WAF is expired. 

C. HTTP traffic is not forwarding to HTTPS to decrypt. 
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D. Old, vulnerable cipher suites are still being used. 

Answer: C 

Explanation: 

This could be the cause of the lack of visibility from the WAF (Web Application Firewall) for the web 
application, as the WAF may not be able to inspect or block unencrypted HTTP traffic. To solve this issue, 
the web server should redirect all HTTP requests to HTTPS and use SSL/TLS certificates to 

encrypt the traffic. 


8.A security analyst is reviewing the following output: 

Request URL: http://www. largeworldwidebank.org/../../../etc/password 

Request Method: GET 

Status Code: 200 OK 

Remote Address: 107.240.1.127:443 

Content-Length: 1245 

Content-Type: text/html 

Date: Tue, 03 Nov 2020 19:47:14 GMT 

Server: Microsoft-IIS/10.0 

X-Powered-By: ASP.NET 

Accept: text/html, application/xhtml+xml, application/xml;q=0.9, image/webp, image/apng, */*;q=0.8 
Accept-Encoding: gzip, deflate 

Accept-Language: en-US,en;q=0.9 

Cache-Control: max-age=0 

Connection: keep-alive 

Host: www. largeworldwidebank.org/ 

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/67.0.3396.87 Safari/537.36 

Which of the following would BEST mitigate this type of attack? 

A. Installing a network firewall 

B. Placing a WAF inline 

C. Implementing an IDS 

D. Deploying a honeypot 

Answer: B 

Explanation: 

The output shows a SQL injection attack that is trying to exploit a web application. A WAF (Web 
Application Firewall) is a security solution that can detect and block malicious web requests, such as SQL 
injection, XSS, CSRF, etc. Placing a WAF inline would prevent the attack from reaching the web server 
and database. 

Reference: 

https://owasp.org/www-community/attacks/SQL_Injection 


https://www.cloudflare.com/learning/ddos/glossary/web-application-firewall-waf/ 


9.Which of the following terms refers to the delivery of encryption keys to a CASB or a third-party entity? 
A. Key sharing 

B. Key distribution 

C. Key recovery 

D. Key escrow 

Answer: D 

Explanation: 

Key escrow is a process that involves storing encryption keys with a trusted third party, such as a CASB 
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(Cloud Access Security Broker) or a government agency. Key escrow can enable authorized access to 
encrypted data in case of emergencies, legal issues, or data recovery. However, key escrow also 
introduces some risks and challenges, such as trust, security, and privacy. 

Reference: 

https://www.techopedia.com/definition/1772/key-escrow 
https://searchsecurity.techtarget.com/definition/key-escrow 


10.An organization is implementing a new identity and access management architecture with the 
following objectives: 

Supporting MFA against on-premises infrastructure 

Improving the user experience by integrating with SaaS applications 

Applying risk-based policies based on location 

Performing just-in-time provisioning 

Which of the following authentication protocols should the organization implement to support these 
requirements? 

A. Kerberos and TACACS 

B. SAML and RADIUS 

C. OAuth and OpenID 

D. OTP and 802.1X 

Answer: C 

Explanation: 

Reference: 
https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/migrate-application-authentication- 
to-azure-active-directory 

OAuth and OpenID are two authentication protocols that can support the objectives of the organization. 
OAuth is a protocol that allows users to grant access to their resources on one site (or service) to another 
site (or service) without sharing their credentials. OpenID is a protocol that allows users to use an existing 
account to sign in to multiple websites without creating new passwords. Both protocols can support MFA, 
SaaS integration, risk-based policies, and just-in-time provisioning. 

Reference: https://authO.com/docs/protocols/oauth2 https://openid.net/connect/ 


11.Which of the following allows computation and analysis of data within a ciphertext without knowledge 
of the plaintext? 

A. Lattice-based cryptography 

B. Quantum computing 

C. Asymmetric cryptography 

D. Homomorphic encryption 

Answer: D 

Explanation: 

Reference: https://searchsecurity.techtarget.com/definition/cryptanalysis 

Homomorphic encryption is a type of encryption that allows computation and analysis of data within a 
ciphertext without knowledge of the plaintext. This means that encrypted data can be processed 
without being decrypted first, which enhances the security and privacy of the data. Homomorphic 
encryption can enable applications such as secure cloud computing, machine learning, and data 
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analytics. 

Reference: 

https://www.ibm.com/security/homomorphic-encryption 
https:/Awww.synopsys.com/blogs/software-security/nhomomorphic-encryption/ 


12.A company is looking to fortify its cybersecurity defenses and is focusing on its network infrastructure. 
The solution cannot affect the availability of the company’s services to ensure false positives do not drop 
legitimate traffic. 

Which of the following would satisfy the requirement? 

A. NIDS 

B. NIPS 

C. WAF 

D. Reverse proxy 

Answer: A 

Explanation: 

Reference: 
https://subscription.packtpub.com/book/networking-and-servers/9781782174905/5/chO5Ivl1sec38/differe 
ntiating-between-nids-and-nips 

https://owasp.org/www-community/controls/Intrusion_Detection 

ANIDS (Network Intrusion Detection System) is a security solution that monitors network traffic for signs 
of malicious activity, such as attacks, intrusions, or policy violations. A NIDS does not affect the availability 
of the company’s services because it operates in passive mode, which means it does not block or modify 
traffic. Instead, it alerts the network administrator or other security tools when it detects an anomaly or 
threat. 

Reference: 
https:/Awww.cisco.com/c/en/us/products/security/what-is-network-intrusion-detection-system.html 
https:/Awww.imperva.com/learn/application-security/network-intrusion-detection-system-nids/ 


13.A disaster recovery team learned of several mistakes that were made during the last disaster recovery 
parallel test. Computational resources ran out at 70% of restoration of critical services. 

Which of the following should be modified to prevent the issue from reoccurring? 

A. Recovery point objective 

B. Recovery time objective 

C. Mission-essential functions 

D. Recovery service level 

Answer: D 

Explanation: 

Reference: https://www.nakivo.com/blog/disaster-recovery-in-cloud-computing/ 

The recovery service level is a metric that defines the minimum level of service or performance that a 
system or process must provide after a disaster or disruption. The recovery service level can include 
parameters such as availability, capacity, throughput, latency, etc. The recovery service level should be 
modified to prevent the issue of running out of computational resources at 70% of restoration of critical 
services. The recovery service level should be aligned with the recovery point objective (RPO) and the 
recovery time objective (RTO), which are the maximum acceptable amount of data loss and downtime 
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respectively. 

Reference: 
https://Awww.techopedia.com/definition/29836/recovery-service-level 
https://www.ibm.com/cloud/learn/recovery-point-objective 
https://www.ibm.com/cloud/learn/recovery-time-objective 


14.A technician is reviewing the logs and notices a large number of files were transferred to remote sites 
over the course of three months. This activity then stopped. The files were transferred via TLS-protected 
HTTP sessions from systems that do not send traffic to those sites. 

The technician will define this threat as: 

A. a decrypting RSA using obsolete and weakened encryption attack. 

B. a zero-day attack. 

C. an advanced persistent threat. 

D. an on-path attack. 

Answer: C 

Explanation: 

Reference: https://www.internetsociety.org/deploy360/tls/basics/ 

An advanced persistent threat (APT) is a type of cyberattack that involves a stealthy and continuous 
process of compromising and exploiting a target system or network. An APT typically has a specific goal 
or objective, such as stealing sensitive data, disrupting operations, or sabotaging infrastructure. An APT 
can use various techniques to evade detection and maintain persistence, such as encryption, proxy 
servers, malware, etc. The scenario described in the question matches the characteristics of an APT. 
Reference: https://www.cisco.com/c/en/us/products/security/what-is-apt.html 
https:/Awww.imperva.com/learn/application-security/advanced-persistent-threat-apt/ 


15.A security engineer thinks the development team has been hard-coding sensitive environment 
variables in its code. 

Which of the following would BEST secure the company’s CI/CD pipeline? 

A. Utilizing a trusted secrets manager 

B. Performing DAST on a weekly basis 

C. Introducing the use of container orchestration 

D. Deploying instance tagging 

Answer: A 

Explanation: 

Reference: https://about.gitlab.com/blog/2021/04/09/demystifying-ci-cd-variables/ 

A trusted secrets manager is a tool or service that securely stores and manages sensitive information, 
such as passwords, API keys, tokens, certificates, etc. A trusted secrets manager can help secure the 
company’s CI/CD (Continuous Integration/Continuous Delivery) pipeline by preventing hard-coding 
sensitive environment variables in the code, which can expose them to unauthorized access or leakage. A 
trusted secrets manager can also enable encryption, rotation, auditing, and access control for the secrets. 
Reference: 

https://www.hashicorp.com/resources/what-is-a-secret-manager 
https://dzone.com/articles/how-to-securely-manage-secrets-in-a-ci-cd-pipeline 


